THREAT OPS › Threat News › [NVD] CVE-2026-21711 (MEDIUM 5.3) — A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under `--permission` without `--allow-net` can
[NVD] CVE-2026-21711 (MEDIUM 5.3) — A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can
CVE-2026-21711 CVSS: 5.3 MEDIUM Published: 2026-03-30T20:16:19.260
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing comm
Indicators of compromise
- CVE-2026-21711cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-21711